Trust
Trust comes from keeping responsibilities narrow.
SupahID presents the experience. Ledgr owns identity and authentication. Stripe performs the identity check. Your authenticator keeps the private passkey key.
Government ID and live selfie
Stripe Identity performs the configured US verification ceremony. Supah receives only the provider, external session reference, status, and verification time.
What Supah does not receive
SupahID and Ledgr do not request or store document images, document fields, selfie or liveness details, biometrics, expanded reports, derived identity anchors, or duplicate-human bindings.
Password plus passkey
Normal sign-in requires both factors. Ceremonies expire after five minutes and can be consumed once. Private passkey keys remain exclusively in the authenticator.
Private by default
A Persona begins private and stays absent from public discovery until its owner publishes it. The owner can edit it or make it private again.
Application-scoped identity
Future application integrations use pairwise subjects. Applications must not receive a global SupahID, internal Ledgr identifier, another application's grant, or unrequested Persona fields.
Consent and revocation
Application sharing will require explicit scopes and a hosted consent experience. Durable grant and revocation controls are not yet broadly available and will be clearly labeled when launched.
Account deletion
The owner portal provides account deletion. Deletion revokes sessions and removes customer-visible profile and authentication material under Ledgr's deletion policy.
Security contact
Report a vulnerability to security@supah.dev. Do not include passwords, passkey assertions, identity documents, or selfies in the initial report.